Skip to content

Commit e05274a

Browse files
author
Ming Lei
committed
block: refine the EOF check in blkdev_iomap_begin
JIRA: https://issues.redhat.com/browse/RHEL-43906 CVE: CVE-2024-38604 commit 0c12028 Author: Christoph Hellwig <hch@lst.de> Date: Fri May 3 10:10:42 2024 +0200 block: refine the EOF check in blkdev_iomap_begin blkdev_iomap_begin rounds down the offset to the logical block size before stashing it in iomap->offset and checking that it still is inside the inode size. Check the i_size check to the raw pos value so that we don't try a zero size write if iter->pos is unaligned. Fixes: 487c607 ("block: use iomap for writes to block devices") Reported-by: syzbot+0a3683a0a6fecf909244@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig <hch@lst.de> Tested-by: syzbot+0a3683a0a6fecf909244@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20240503081042.2078062-1-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Ming Lei <ming.lei@redhat.com>
1 parent 1389e5b commit e05274a

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

block/fops.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,7 @@ static int blkdev_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
387387

388388
iomap->bdev = bdev;
389389
iomap->offset = ALIGN_DOWN(offset, bdev_logical_block_size(bdev));
390-
if (iomap->offset >= isize)
390+
if (offset >= isize)
391391
return -EIO;
392392
iomap->type = IOMAP_MAPPED;
393393
iomap->addr = iomap->offset;

0 commit comments

Comments
 (0)